hxxp://www[.]opusfundservices[.]com

Analysis

max time kernel
1260s
max time network
1215s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.opusfundservices.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
1304	chrome.exe
1304	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe
Token: SeShutdownPrivilege	4056	chrome.exe
Token: SeCreatePagefilePrivilege	4056	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe
4056	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3236	4056	chrome.exe	45
PID 4056 wrote to memory of 3236	4056	chrome.exe	45
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4016	4056	chrome.exe	85
PID 4056 wrote to memory of 4420	4056	chrome.exe	86
PID 4056 wrote to memory of 4420	4056	chrome.exe	86
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87
PID 4056 wrote to memory of 1788	4056	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.opusfundservices.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa75859758,0x7ffa75859768,0x7ffa75859778
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:2
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4660 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5348 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5616 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3392 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:8
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 --field-trial-handle=1892,i,9435002666898196429,2510612121026650037,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
b452bb25bb0336b3b531aaff46792e7a

SHA1
7f674c3096e496b8ff7cbe63a4df326beb22a0d0

SHA256
0a7665e86d1089a1edbf0f8c15ed4f6995ff3bf6dfc0bcdbb2cc14f7e12dfd2d

SHA512
9152d2877284beb0e1aa4114ff0c81daf5d7f8a91764e64da92923f6c38acc834ea959eeb0c499ad37822c493651b7c2341b975b91fa5afeb618f65ebeb354f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
3bc163788820b22a9d593b921d5b4ddd

SHA1
7569ce49f51c63b83e1afa63d042ce6cb4cca905

SHA256
e317912569a20e9a4f8849d208d31435bbd26373cc86d3ee576ce8304c94baf2

SHA512
8d7c3375b1d707e64f2f9564589dcf097a138a3d38c105a4c315767c7cf8fad3594f3f27b2f27239e0b4a7614849ef7c021dda797a1bade72f17f74e268f1958

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
4c75148c442c25290ca0c8310bb05fae

SHA1
8bc0a3e40de5169e0a1fcb16a65f56f1a489efe4

SHA256
5885d72b6fc6c9599d4b764a121c1f8f937a69fbe289697460fe034c735afe83

SHA512
fbbb63278dae6a3279211a1f198469deb850b4b43f1b6a8e82ed94bf6db258f15c045cf5da031cfcac7ffc7a76330b233bc8ca61b8890b83e39301e8098acdca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
3c3254be70817a61470acf95b07ffd8a

SHA1
bb5a86b2a4a984717a7bffc1570832f7b991c223

SHA256
f6907ee07acd1486fd8a45f1131860bc98626faf0826836a3d56dda7d004b159

SHA512
0cf748476a045785c0cd92cb151d59736fa0c705b64d70cbbd755ebf9d11551c3671cde355f77d02f8c378da5e8b76f812c17ee0ea99b5ca9d91b8b1d17fb82e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bdf6d854f8748a45f57450bb5f5a095a

SHA1
dfc4dbc62d0346e9333e4e844857cf73720db0cd

SHA256
8856991eb09aabf7b6402fb1f5b3fae528bf03f0e28d7f7509ccf7dde24ae32f

SHA512
0870a6525b5e6a9528adec3d93286220cc2651df197fae79e51fcea463527551a56066b24465f6fc0f831d17a5b29f7834b3076ade0f9297cde40cd31acc0cc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d138572e7ae5e30c91dfa87d86d39948

SHA1
cdfe809b19e5a4c333ecb352bd5d57aaa3bd02d1

SHA256
4c44c371032af1093f1b47bddfef0e35b61ad95d76f05203674a11f945621f01

SHA512
510aa23e43c4aee7c6186590567a3e47869f91d3bb8e7d257afbc0e55db783c6720a4587c4c658338c68c9d85528c231c23b0f5e749e83e13d35aa39468bcbaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3d52e5b83111349070bd8e85a8717a3c

SHA1
75725db24ec686f74efc4c08b701fcfa77eadcdb

SHA256
51480f7391e62773031c80166f2339e85b7d64ddd09c2ee262d18afb707de432

SHA512
3fc6f1d019b2261bb4842ebb4f016c9d5d09d731d2fde3a275875bdae01499c4c8a468ce582a06e6334160b4c638385fa32941b702f3cdce857e9f959d94e093

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e653aa74ccf16c2dba883e2a5bf53052

SHA1
271802ea87160be7b2a2db8e8fde56330221b40e

SHA256
f71874c3c957f3f0cbc63e67ff49777a1d3389e83491ce05f111980b8789dfd9

SHA512
b26dfe33ca6d06c11b6ac2b49a5353b96d2609322cc87616410cadb716423f9d9aded7e4cd8d70ef15a1c3b6f40afc6fa518115a857b9962c67acf892ebbe53b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a9901e0eb90aaa9fc425795a8e2cab57

SHA1
b5f2871101e45c1946343895b2ffc0884a026903

SHA256
e9a245d6c1701ececa77fd3c563c17eab203d5e12f8825fce66b8e08ed038291

SHA512
fd984dba412363f18725bb063c3b214f6e2ff96a5a418f9720055c48652af7f7e27a6ae55e11fceed1f4bfc84fe1f3f7000c2c81af69146eef66110270029e91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c25ee6231d9cc75ca1096c537eb21cf7

SHA1
0e14091432102323cf9186483c68eb289fd8d873

SHA256
6eb64965265c74a04af31264509aebc0c78098934e0109363ac6c7fc9d212c1c

SHA512
7cf70c4762b12eeff3d1ec94d3cdf86e2d7340ea36c564a636b816af3bcf9a5bb0838651abf9ab93f272e9775eecad3cc7a577287b0ec55b48355e6977cf9b3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d15690d7915cfe61f8c6333446483eb4

SHA1
99022ebd90e08e0e7d51a5ed62a124c287e59513

SHA256
00e2b268b7954ffad4b82967ce8c4f1fa5b8749bddde3b53ed44326650e60084

SHA512
5958843a947b6d881d023060ba5787dab2bf30f5d7970a46dce23c1cc78c69f87c3e5b8be0458eadd8b5e82471b4211dcc32467c2833e4c20b7dc4cc6a2e050b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
8b88cb9b1b09e5ed6ef787df092f8803

SHA1
8f0d10818d2a8eb4a997209bfd05dd6429ff66c9

SHA256
db532b4b182369afa31b49bcf24f94820e2e225428055c45d38f62e3cbaf1d0f

SHA512
b7db5a4d1a105b52302404cf14a765648f43349a8dbfdc2b15e81173921ebf4edba7e6e790a20f8352f29cf5df659081b3424dfec2abf21951ee279bf65f20fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
2f1e0909f21cd004d325b825c19c8909

SHA1
0dd81ef5f0f8355c888195c433570d02d3efd3e5

SHA256
702f5e60360ee8b85356f334fdef12efb224af9db6968b8dfd2024a0f1648d0a

SHA512
bb84a5033aa6035b7a0971b7be022e821c3f98163d531f801bd82a1d68286000f08d312cb2865ee744bb165953b4e9d064b05bb3f5197e3ba9949abc66aec64b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
71697434a786900ac3c4ed9aba134c48

SHA1
f164c75ef633d48120bc298ae0d445f94e34d75e

SHA256
b80156a40edc49138bf5f73c85ef758537b441afa893b9cd80628db161c6bb1e

SHA512
b938cb7ce4242176d3a985121716981518d4992f661077fc7592cdb45d0b6ec2d719e4cf306c565f5272e21dc62a26a69392aa39c0800132a87ccccd39fdb238

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
cefa3f4a13c69b8f2126dc6e6a1694de

SHA1
85fb054fef0c7e18612b5a6f5893f86a00f7832a

SHA256
f0e17444c26ebfe56a9928741d63e2b9de31729f0ccad709de432c6bc60bfd67

SHA512
c00a9b394eafb2999918c404271e5b1995cc366c4050527e49b45e00d69138dcc1428d7b32a54ae48c5c8a8053488c819493e84b4a1065811c5b5556c7f70e14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f30b.TMP

Filesize
103KB

MD5
c282f9baa104e1cd08d409dfd304405d

SHA1
a512269977bf18c42bf71c011b1ac26992dcd659

SHA256
0f8a14e3e66ea48ca3895811079c5967b1d9eaf828b9cd45da1869802776b6d5

SHA512
f37a05d3614167960627d41706a42e9054388f28aec644eda500b7954f0c2c3087efbe15d78e4371b356c7c494d4798566e622c566b4ede2daa00b46cefe0c67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit